CVE-2025-20284
published 2025-07-16CVE-2025-20284: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying…
PriorityP261high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
12.68%
95.8th percentile
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root.
This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | identity_services_engine | < 3.3.0 | 3.3.0 |
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine_authenticated | — | — |
| cisco | identity_services_engine_passive_identity_connector | < 3.3.0 | 3.3.0 |
| cisco | identity_services_engine_passive_identity_connector | — | — |
| cisco | identity_services_engine_passive_identity_connector | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is exploitable via a crafted API request to a specific API endpoint in Cisco ISE / ISE-PIC; monitor for anomalous or malformed API requests from authenticated high-privileged accounts ↗
- →Successful exploitation results in command execution as the root user on the underlying OS; monitor for unexpected root-level process spawning from the ISE application process ↗
- →Root cause is insufficient input validation (CWE-74 injection) in the API layer; look for injection-style payloads (e.g., shell metacharacters) in API request bodies directed at Cisco ISE ↗
- →A companion vulnerability in the same advisory covers IP access filter bypass (CWE-302); correlate with unexpected source IPs successfully reaching ISE management APIs that should be blocked by access filters ↗
- →Track Cisco Bug IDs CSCwp02806, CSCwp02811, CSCwp02819 for vendor patch/detection guidance updates ↗
- ·Exploitation requires valid high-privileged (admin-level) credentials; this is not an unauthenticated attack vector. Detections should be scoped to authenticated sessions. ↗
- ·No workarounds are available from Cisco; patching via software updates is the only remediation path. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w5q9-32xf-9fxh: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underl
ghsa_unreviewed·2025-07-16
CVE-2025-20284 [MEDIUM] CWE-74 GHSA-w5q9-32xf-9fxh: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underl
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root.
This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.
Cisco
Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities
vendor_cisco·2025-07-16·CVSS 6.5
CVE-2025-20283 [MEDIUM] CWE-302 Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities
Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to issue commands on the underlying operating system as the root user and allow IP access filters to be bypassed.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
For more information about these vulnerabilities, see the Details section of this advisory.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO
Cisco
Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2025-20284 Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities
CVE-2025-20284: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to issue commands on the underlying operating system as the root user and allow IP access filters to be bypassed. Cisco has released software updates that address these vulnerabilities. There are no
CVSS: 3.1
CWE: CWE-302, CWE-74, CWE-302, CWE-74
Bug IDs: CSCwp02806, CSCwp02811, CSCwp02819, CSCwp02806, CSCwp02819
No detection rules found.
No public exploits indexed.
2025-07-16
Published